CVE-2024-46982
Next.js Cache Poisoning
Impact
### Impact By sending a crafted HTTP request, it is possible to poison the cache of a non-dynamic server-side rendered route in the pages router (this does not affect the app router). When this crafted request is sent it could coerce Next.js to cache a route that is meant to not be cached and send a `Cache-Control: s-maxage=1, stale-while-revalidate` header which some upstream CDNs may cache as well. To be potentially affected all of the following must apply: - Next.js between 13.5.1 and 14.2.9 - Using pages router - Using non-dynamic server-side rendered routes e.g. `pages/dashboard.tsx` not `pages/blog/[slug].tsx` The below configurations are unaffected: - Deployments using only app router - Deployments on [Vercel](https://vercel.com/) are not affected ### Patches This vulnerability was resolved in Next.js v13.5.7, v14.2.10, and later. We recommend upgrading regardless of whether you can reproduce the issue or not. ### Workarounds There are no official or recommended workarounds for this issue, we recommend that users patch to a safe version. #### Credits - Allam Rachid (zhero_) - Henry Chen
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | next | >= 13.5.1, < 13.5.7 | 13.5.7 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vercel | Next.Js | from 13.5.1 before 13.5.7 from 14.0.0 before 14.2.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3
- https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda
- https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9
- https://github.com/advisories/GHSA-gp8f-8m3g-qvj9
- https://nvd.nist.gov/vuln/detail/CVE-2024-46982